Robot control method

ABSTRACT

A method for controlling a robot includes the steps of: deciding whether there is a non-permanent object in a vicinity of the robot; if there is a non-permanent object, deciding whether the object qualifies for extended protection or not; and defining a safety zone around the object which the robot must not enter or in which a maximum allowed speed of the robot is less than outside the safety zone. The safety zone extends to a greater distance from the object if the object qualifies for extended protection than if it does not.

CROSS-REFERENCE TO PRIOR APPLICATION

This application is a continuation of International Patent ApplicationNo. PCT/EP2018/070161, filed on Jul. 25, 2018, which claims priority toEuropean Patent Application No. EP 17184381.6, filed on Aug. 2, 2017,and European Patent Applicant No. EP 17194103.2, filed on Sep. 29, 2017.The entire disclosure of the foregoing applications is herebyincorporated by reference herein.

FIELD

The present invention relates to a method for controlling a robot and toa robot system in which the method is used.

BACKGROUND

Wherever robots are used in industry, protecting staff from injurythrough the robots is a prime concern. Conventionally, enclosures havebeen built around the robots, equipped with alarms which cause anemergency stop of the robot whenever a person opens the enclosure. Suchrobots can only accomplish fully automatized, highly repetitive tasksthat require no human intervention at all. A direct interaction betweenrobot and human is not possible.

In order to enable robots and humans to cooperate without beingseparated by an enclosure, more sophisticated security concepts arerequired. One such concept is known as speed and separation monitoring(SSM), described in ISO/TS 15066:2016—Robots and roboticdevices—Collaborative Robots, clause 5.5.4. SSM aims to maintain acertain combination of distance between human and robot and robot motionspeed, so as to ensure that the human in the robot work space cannotreach the moving robot. To achieve this, the position of the human mustbe determined and the robot must adjust its speed and/or trajectoryaccordingly, maintaining a safe distance from the human.

A sensor having the spatial resolution required for detecting theposition of the human, such as a video camera or a radar system, is notper se capable of distinguishing between humans and non-human, inparticular inanimate, objects. Motion as such is not a criterion, sinceany object newly appearing within the detection range of the sensor, canonly have got there by moving or by having been moved. However, if anyobject detected by the sensor is assigned a safe distance which would beappropriate for a human, interaction between human and robot would stillbe practically impossible since the robot would be unable to touch anyobject brought into its reach, and the robot might easily be slowed downor even prevented from carrying out a programmed task by an object itcannot pass without violating its safe distance.

SUMMARY

In an embodiment, the present invention provides a method forcontrolling a robot, comprising the steps of: deciding whether there isa non-permanent object in a vicinity of the robot; if there is anon-permanent object, deciding whether the object qualifies for extendedprotection or not; and defining a safety zone around the object whichthe robot must not enter or in which a maximum allowed speed of therobot is less than outside the safety zone, wherein the safety zoneextends to a greater distance from the object if the object qualifiesfor extended protection than if it does not.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be described in even greater detail belowbased on the exemplary figures. The invention is not limited to theexemplary embodiments. Other features and advantages of variousembodiments of the present invention will become apparent by reading thefollowing detailed description with reference to the attached drawingswhich illustrate the following:

FIG. 1 is a schematic plan view of a robot and its vicinity;

FIG. 2 is a plan view in which an object qualifying for extendedprotection is entering the vicinity;

FIG. 3 is a diagram illustrating exemplary changes of the qualificationof objects in the vicinity of the robot;

FIG. 4 is another plan view of the robot and its vicinity;

FIG. 5 is another diagram illustrating exemplary changes of thequalification of objects; and

FIG. 6 is a flowchart of a method carried out in a processor unit thatcontrols the robot.

DETAILED DESCRIPTION

In an embodiment, the present invention provides a method forcontrolling a robot which ensures the necessary safety for humans in thevicinity of the robot while avoiding unnecessary limitations in thefreedom of movement of the robot.

In an embodiment, the present invention provides a method forcontrolling a robot comprising the steps of:

a) deciding whether there is a non-permanent object in the vicinity ofthe robot;

b) if there is a non-permanent object, deciding whether the objectqualifies for extended protection or not, and

c) defining a safety zone around the object which the robot must notenter or in which a maximum allowed speed of the robot is less thanoutside said zone, wherein the safety zone extends to a greater distancefrom said object if it qualifies for extended protection than if it doesnot;

d) The safety zone is updated in real time and always contains and goeswith the object. The safety zone also contains an additional marginsurrounding the object, which takes into account the sensor system delayand the maximum speed of the object.

If an object does not qualify for extended protection, the distance towhich the safety zone extends may be zero; i.e. the robot may be allowedto touch or even to grip and manipulate the object.

The vicinity can be regarded as equivalent to the detection range of thesensor or of a plurality of sensors on whose outputs the decision ofstep a) is based.

In principle, an object which qualifies for extended protection shouldbe any human, whereas an object which does not should be inanimate.However, when an object has newly entered the vicinity of the robot, itmay not yet be possible to tell whether it is human or not; therefore,when an object is detected to enter the vicinity of the robot, it shouldinitially be judged to qualify for extended protection, notwithstandingthat this judgment may be reversed later, when more information on theobject has been gathered.

Workpieces also have to be brought into the vicinity in order to beworked upon by the robot. If these were initially judged to qualify forextended protection as mentioned above, the robot would be preventedfrom touching them and working on them at least until the informationhas been gathered by which the workpiece can be judged to be inanimate,whereby the work of the robot would be slowed down considerably. Inorder to avoid unnecessary delays in the operation of the robot, aworkpiece entry point should be defined in the vicinity of the robot, sothat an object which enters the vicinity by the workpiece entry pointcan be judged not to qualify for extended protection. In that case, ofcourse, the vicinity of the robot should be designed so that theworkpiece entry point is inaccessible to a human from outside thevicinity.

For a first object which was found not to qualify for extendedprotection (also referred to subsequently as non-qualifying object) thesafety distance can be set very low or even zero because the firstobject can safely be expected not to move unpredictably and possibly hitthe robot. Of course such an assumption is no longer valid if the firstobject is seized by a human. Therefore, if the distance between thefirst object and a second object becomes less than a predeterminedlimit, and at least one of the objects has been judged to qualify forextended protection, then the other object is judged to qualify, too.

Such a change in the qualification of the first object causes an abruptincrease of its safety zone, by which the robot may suddenly find itselfin the safety zone without having moved. In order to avoid the need forabruptly braking the robot in such a case, it is useful to requalify thefirst object before the human actually has been able to seize it, i.e.at a time when the distance between the second object (which might be ahuman) and the first object is not yet less than a pre-set threshold,which is defined as to characterize seizure of the first object by thehuman, this threshold may be defined as zero or as close to zero.

If it turns out later that the second object has passed by the firstobject—i.e. the distance between the objects increases again—without thedistance actually having become less than the preset threshold, thestatus of the first object can be reverted to non-qualifying.

If two objects come close enough to each other to becomeundistinguishable, typically because a human seizes an inanimate objector the human is partly or fully shadowed by the object in the directionof sensor detection, the combined object resulting therefrom should alsobe judged to qualify for extended protection.

If such an object splits into two or more objects, e.g. because thehuman puts down a previously seized object, it may be impossible, atleast until enough data for a reliable judgment have been gathered, totell whether one of the two objects is indeed inanimate. Therefore, thequalification for extended protection should be inherited by each of theobjects resulting from the split.

The decision that an object is most probably inanimate and doestherefore not qualify for extended protection can be based on variouscriteria.

One criterion is the absence of detectable motion of the object. Anadvantage of this criterion is that it can be examined, albeit roughly,at no extra cost, using the same spatially resolving sensor as fordetection of the object. Reliability of the criterion is considerablyimproved if a highly sensitive sensor capable of detecting micro-motiondue to respiration or heartbeat is used, as described e.g. in US 2011025547 A1 or US 2014 316261 A1.

As another criterion, it can be judged whether a physical property ofthe object such as size, shape, weight or surface temperature isincompatible with a human being or not. Judgment of shape and size canalso be carried out based on data from the spatially resolving sensormentioned above. Such a judgment must take account of the fact that adetected object may comprise a human and an inanimate object carried byhim, so that an object can be judged not to qualify with certainty ifthe shape or a dimension of the object is too small for a human to fitin.

For a judgment based on weight or surface temperature, additionalsensors become necessary, such as weight-sensitive sensor mats coveringthe floor of the robot's vicinity, a pyrometer for contact-freetemperature measurement, or the like.

Judgment may also be facilitated by the use of specific tags. Objectswhich are intended to be used in the vicinity of the robot, e.g.workpieces to be worked on by the robot, tools etc. can be provided withtags that are adapted to be read by a sensor of the robot system andwhich specify the nature of the tagged object. There can be an opticaltag, e.g. a QR tag, which can be read by a camera serving as thespatially resolving sensor; an RFID tag has the advantage that it can beread regardless of whether it faces a sensor antenna or not.

The data of the tag should not be used as the sole indicator of thenature of an object; it should be checked whether the data read from thetag fit detectable physical properties of the detected object, in orderto find out whether the detected object is only the tagged object orwhether it is a combination of the tagged object and another object,which might be a human carrying the tagged object.

Judgement can also be made or inferred from a predefined computer model,for example, CAD or virtual reality model for the already known devicesand fixed setup of equipment in the scenery. The computer model,considered as a “digital twin” of the real environment, can beperiodically rescanned for an update of environment changes.

If pre-defined criteria do not allow for a certain judgment, thepossibility should be provided for an operator to declare whether anobject qualifies for extended protection or not.

Further objects of the invention are a robot system comprising a robot,a sensor system for surveilling a vicinity of the robot and a processorunit for controlling the robot based on data from the sensor systemusing the method as described above, and a computer program productcomprising program code means which enable a computer to perform themethod.

FIG. 1 is a schematic plan view of an industrial robot 1 and its workingenvironment. In the embodiment shown here, the robot 1 has a stationarybase 2, one articulated arm 3 and an end effector 4 at the free end ofthe arm, but it should be kept in mind that the method which will bedescribed subsequently is also applicable to more complex systems inwhich the robot is mobile and/or in which it comprises more than one armand/or more than one end effector.

The motion of the robot 1 is controlled by a processor unit 5, typicallya microcomputer, in order to carry out a predefined manufacturing task,for example combining each of a series of first workpieces 6, suppliedby a conveyor 7, with a second workpiece 8, taken from a crate 9.

The processor unit 5 may comprise two functionally separate butcooperating processor units: A first processor unit for controlling therobot, and a second processor unit for sensor data evaluation. Both canbe within the same electronics rack, but can also be set up apart fromeach other. Functionally both together make up the processor unit 5.

The processor unit 5 is connected to a spatially resolving sensor 10which is designed and positioned to monitor the vicinity of the robot 1.In the following the vicinity of the robot 1 and the region in space inwhich objects can be detected by the sensor 10 will be regarded asidentical, assuming that the sensor 10 has been set up appropriately todetect any object that might approach the robot 1 and collide with it,no matter from which direction. In FIG. 1, the sensor 10 is representedas a single camera. In practice it may comprise several cameras viewingthe vicinity of the robot 1 from different directions, so that no objectcan be hidden from all cameras at a time by the robot 1, and so that theprocessor unit 5 can determine coordinates of an object seen by morethan one camera by triangulation.

Of course any other type of sensor capable of providing spatiallyresolved information on objects in the vicinity of the robot 1 can beused as or combined into the sensor 10, e.g. a radar device, one or morelaser or microwave scanners, weight-sensitive tiles on the floor aroundbase 2, etc.

In FIG. 1 the space in which the robot 1 is working is partiallyconfined by walls or barriers 11. Part of these walls or barriers 11 isin the detection range of sensor 10. One of the walls 11 has a passage12 through which a moving object might at any time enter the vicinity ofthe robot 1 and collide with it. While a contact between the object andthe robot 1 may be desired and should not be prevented, it should bemade sure that when such a contact occurs, the robot 1 is at rest andcannot damage the object. Therefore, at all times, the processor unit 5defines a safety zone 13 which extends from the passage 12 into thevicinity and which it will not allow the robot 1 to enter. The dimensionof the safety zone 13 is determined by the condition that whenever anobject enters the vicinity through passage 12 with a reasonable speed,e.g. of a quickly walking human, it shall be possible to bring the robotto rest before the object and the robot 1 can touch each other.

The size of the safety zone 13 may vary depending on the instantaneousspeed of the robot. The faster the robot 1 moves, the longer is the timeneeded to bring it to a standstill, and the longer is the distance anintruding object would cover in that time; therefore the width of thesafety zone 13 can be adapted to the robot speed.

Further, the direction of the robot movement can be taken into account,making the safety zone 13 larger when the robot 1 is approaching thepassage 12, and making it narrower when the robot 1 is moving away fromit.

The detection range of the sensor 10 can be limited not only by walls 11but also by objects such as e.g. an electronics rack 14 accommodatingprocessor unit 5, which might be movable but are usually not moved whilethe robot 1 is operating. In the plan view of FIG. 1 there is a passage15 between the rack 14 and the conveyor 7 which is hidden from thesensor 10 and from which a further safety zone 16 defined according tothe same criteria as described above for safety zone 12 extends into thevicinity of the robot 1.

While it may be possible for the processor unit 5 to determine theposition of the walls 11, the rack 14 and the conveyor 7 from dataprovided by sensor 10, the passages 12, 15 cannot be detected by thesensor 10. Therefore, when the system of FIG. 1 is set up, the processorunit 5 may be provided with a geometrical model of the vicinity in whichall passages by which a human might enter are specified.

The system of FIG. 1 has at least one more passage, 17, namely the oneby which first workpieces 6 enter the vicinity. A safety zone assignedto this passage 17 might be a nuisance for operation of the robot 1,since it might have to be considered when controlling the movement ofthe robot 1 between the crate 9 and the conveyor 7. Therefore, thispassage 17 has no safety zone assigned to it. The lack of a safety zonehere may be justified pragmatically by the assumption that no human willvoluntarily sit on the conveyor and that therefore the possibility thatan object qualifying for extended protection might approach the robot 1through passage 17 can be neglected, or it may be justified technicallyby blocking access to an upstream portion of the conveyor 7, beyondpassage 17, or by making passage 17 too small for a human to pass.

When the system is operating, the sensor 10 will detect any firstworkpiece 6 that enters the vicinity by passage 17, but as this passage17 has no safety zone assigned to it, the workpieces 6 are automaticallydetected as what they are, i.e. as objects which do not have to beprotected from contact with the robot but are there to be handled by it.

Things are different if an object 18 enters the vicinity through apassage having a safety zone, as shown in FIG. 2. Here, the object 18entering the vicinity by passage 12 is a person 19 carrying a crate 20.While the object 18 is not in full view of the sensor 10, the processorunit 5 cannot be certain of the nature of the object 18 and must expectit to move unpredictably. Therefore, as a matter of precaution, itregards the object 18 as qualified for extended protection and thereforedefines a safety zone 21 around said object 18 according to the samecriteria as described above for safety zone 13. The object 18 will staysurrounded by this safety zone 21 while it moves in the vicinity of therobot 1 and e.g. replaces the old crate 9 by the new one 20, filled withfresh second workpieces 8.

FIG. 3 illustrates how the judgment of the processor unit 5 on thequalification of the various objects 18, 9 in the vicinity evolves inthe course of this replacement. At the left-hand side of the diagram, atthe beginning of the process (step a), there are two symbols, a squareone at a long distanced from the robot 1, representative of the object18, and a round one, at a small distance, representative of crate 9. Thesymbol of object 18 is cross-hatched, indicative of its qualificationfor extended protection; the symbol of crate 9 is empty, since the crate9 does not qualify, but rather, the workpieces 8 in it are there to bemanipulated by the robot 1.

The qualification statuses of object 18 and crate 9 remain unchanged insteps b and c, while the person 19 approaches crate 9. When the distancebetween both is small enough for the crate 9 to be within an arm'slength of the person 19, i.e. if the distance is less than 0.85 m, theprocessor unit 5 changes the status of the crate 9, indicated bycross-hatching of its symbol in FIG. 3 in step d. Now the safety zone 21is extended to envelop also crate 9, as shown in FIG. 4. The extendedsafety zone 21 prevents the robot 1 from fetching a new second workpiecefrom crate 9.

The person 19 puts down the new crate 20, whereby the crate 20 and theperson 19 become distinguishable as two objects by the sensor 10 and theprocessor unit 5. This is represented by distinct symbols for the crate20 and for the person 19 appearing in step e.

In step f, the person 19 takes up the old crate 9, represented by a newsymbol 22 of a combined object formed of the person 19 and the crate 9,replacing that of crate 9. In the following steps, the combined object21, i.e. the person 19 and the old crate 9 leave the vicinity, while thenew crate 20 stays behind.

If the new crate 19 continued to be protected from contact with therobot 1, the robot 1 couldn't continue work with the new workpieces 8 incrate 20. Therefore, appropriate criteria must be defined which enablethe processor unit to decide that an object no longer qualifies forextended protection and to reduce its safety zone.

One possible criterion for such a decision is the absence of motion. Ifno motion of an object is detected within a predetermined time span, theobject can be assumed to be inanimate and therefore not to need a degreeof protection which would prevent a contact with the robot 1 even if theobject suddenly started to move. The duration of such a time spandepends on the precision with which the sensor 10 is capable ofdetecting motion. If the sensor 10 is sensitive enough to detectmicro-motion related to heartbeat or respiration, a duration of someseconds may be sufficient for a reliable judgment.

Judgment might also be based on temperature. If the object to be judgedis or comprises a human, then at least part of its surface shouldemanate infrared radiation. So, if the sensor 10 comprises a pyrometer,and the pyrometer detects no part of the surface of the object with atemperature that might fit a human body, then the object is most likelyinanimate and can be judged not to qualify for extended protection.

Another criterion which is easy to evaluate is the weight of the object;if it is noticeably different from that of a human, the object can bejudged not to qualify. A disadvantage of this criterion is that theweight cannot be sensed remotely, so that the vicinity of the robot mustbe equipped at considerable cost with appropriate sensors, such as theweight-sensitive tiles mentioned above.

If the sensor 10 comprises a camera, image processing techniques can beused to extract information on the shape and/or dimensions of the objectfrom the data provided by the camera, and extended protection may beruled out if these data allow to exclude the presence of a human, e.g.in case of the crate 19, because it is too small for a human to fit in.

There might be the case that an object which a person brings into thevicinity of the robot 1 moves even after the person has left it behind,e.g. a fan. If motion is a criterion which will prevent the processorunit 5 from changing the status of an object to non-qualifying, the fanwill always enjoy a wide safety zone around it which may impose severelimits on the mobility of the robot 1 and decrease its productivity.Therefore, the processor unit 5 can have a user interface 23 where auser can inspect the objects which the processor unit 5 has found toqualify for extended protection, e.g. by having them highlighted in animage of the vicinity displayed on a screen, and, if necessary, changethe status of an object.

According to a preferred embodiment, the crates 9, 20 carry tags 24 thatcan be read by the sensor 10 and that specify the nature of the objectto which they are attached and/or some of its characteristics. Such atag can be an optical tag, e.g. a QR tag, which can be read using thecamera of sensor 10. Preferably, it is a tag which communicates byradio, such as an RFID tag, a Bluetooth or NFC device, and the processorunit 5 has a radio interface 25 connected to it for communicating withthe tags 24. In that case, when the tag 24 enters the range of radiointerface 25, the processor unit 5 receives data from the tag 24, fromwhich it can draw conclusions on characteristics detectable by sensor10, of an object which may be about to enter or may already have enteredthe vicinity of the robot 1. These data may e.g. specify that the objectcarrying tag 24 is a crate, its size, and other characteristics. Whenthe object 18, comprising the crate 20 and the person 19 carrying it,enters the vicinity, and the sensor 10 detects the characteristics ofthis object 18, the processor unit 5 finds that these do not matchobject 18. Therefore, while the person 19 is moving in the vicinity ofthe robot 1 carrying the crate, data from the tag 24 will never inducethe processor unit 5 to deny extended protection. However, as soon asthe crate 20 is put down and becomes detectable as an object of its own,the processor unit 5 will find the data from tag 24 to match thisobject, so that the crate 20 is found not to qualify for extendedprotection as soon as the distance between it and the person 19 is longenough, in step k of FIG. 3.

An object which does not qualify for extended protection can still havea safety zone, but the width of the safety zone can be substantiallyreduced; in case of the crate 20 such a safety zone may prevent therobot from touching the walls of the crate 19 while being small enoughto allow the robot to reach in the crate 20 and take out workpieces 8without violating the safety zone. Alternatively, a non-qualifyingobject may have no safety zone at all; in that case the robot 1 would beallowed to touch and handle it, e.g. to grab the crate 20 and to pull itfrom where the person 19 put it to a location closer to the conveyor 7.

The diagram of FIG. 5 relates to a situation in which an object movesthrough the vicinity of the robot 1 without actually interactingphysically with other objects therein, e.g. in which person 19 comes inthrough passage 12, works on the robot 1 and walks out again. The firststeps of the diagram are similar to those of FIG. 3; on his way to theend effector 4 of robot 1, the person 19 passes within an arm's lengthof crate 9 and thereby makes it qualify for extended protection, too, instep d. However, since the person 19 leaves the vicinity again withouttouching the crate 9, the status of the crate 9 is reversed to notqualifying in step g. This can be done based on one or a combination ofthe criteria described above, so that after the person 19 has left, therobot 1 returns to normal operation after a certain delay.Alternatively, if the qualifying status has been conferred to the crate9 by the person 19 merely coming close, and if no contact between theseperson and the crate has occurred, so that the two objects have neverbecome undistinguishable, the status of the crate 9 can be returned nonon-qualifying as soon as the person 19 starts to move away from it or,at latest, when the distance between the two objects 9, 19 increasesabove said arm's length or some other appropriately defined threshold,thus minimizing the delay with which normal operation is resumed.

FIG. 6 is a flowchart of a control method of the processor unit 5 whichis continuously reiterated in order to achieve the above-describedbehavior.

In step S1, the processor unit 5 fetches current data on the vicinity ofthe robot, e.g. an image or, if the sensor 10 comprises multiplecameras, a set of images. Based on a pre-defined geometrical model ofthe vicinity, it identifies the permanent objects which form thisvicinity, such as the walls 11, the conveyor 7, the rack 14, andpossibly also the robot 1 itself (S2). Any image details not accountedfor by these objects must be related to non-permanent objects. If any ofthese objects was already present in a previous iteration of the method,data relating to it will have been recorded by the processor unit 5; ifa non-permanent object exists which has moved since the previousiteration or which has newly entered the vicinity, it will be detectedin step S3 since its position as derived from the current sensor datawill not match any of the recorded position data.

If such an object exists and its position is found in step S4 to becloser to a passage 12, 15 or 17 than to any recently recorded position,the object is judged to be new in the vicinity. If the passage was oneof the passages 12, 15 that can be passed by a human (S5), the object ispossibly human and is therefore judged to qualify for extendedprotection in step S6; else, if the entry point was passage 17, it isjudged not to qualify in step S7. The entry point is included in theobject data recorded in step S8.

If in step S4 the object is found to be closer to a previously existingobject than to a passage, then the object is regarded as being identicalto or being a fragment of said previously existing object, and theprotection status and the entry point of said previously existing objectare copied to the present object (S9). In this way, while the object 18of FIG. 2 moves through the vicinity, it is always judged as qualifyingfor extended protection whereas the workpieces 6 moving on conveyor 7 donot. Due to the possibility of fragmentation, when the person 19 setsdown crate 20 in the scenario of FIG. 4 and moves away from it, bothbecome objects of their own and are judged to qualify for extendedprotection.

Step S10 checks whether the copied status of the object is notqualifying and its entry point is one of passages 12, 15. If bothconditions are met, a check is carried out in step S11 whether within anarm's length of the there is another object which does qualify, and ifexists, the status of the object is changed to qualifying (12). This iswhat happened to crate 9 in step d of FIG. 3.

If a current data set is found in step S3 to be identical to apreviously recorded one, it must belong to an object which hasn't movedsince the previous iteration. If the status of the object is notqualifying (S13), nothing happens to it. Else the processing unit 5examines (S14), using one or more of the criteria described above,whether the status may be changed, and changes it to non-qualifying(S15) if the criteria are met.

Step S16 checks whether there is an object whose data have not yet beenprocessed, and if there is, the method returns to step S3 to processanother set of data; if there isn't, the iteration is finished.

While the invention has been illustrated and described in detail in thedrawings and foregoing description, such illustration and descriptionare to be considered illustrative or exemplary and not restrictive. Itwill be understood that changes and modifications may be made by thoseof ordinary skill within the scope of the following claims. Inparticular, the present invention covers further embodiments with anycombination of features from different embodiments described above andbelow. Additionally, statements made herein characterizing the inventionrefer to an embodiment of the invention and not necessarily allembodiments.

The terms used in the claims should be construed to have the broadestreasonable interpretation consistent with the foregoing description. Forexample, the use of the article “a” or “the” in introducing an elementshould not be interpreted as being exclusive of a plurality of elements.Likewise, the recitation of “or” should be interpreted as beinginclusive, such that the recitation of “A or B” is not exclusive of “Aand B,” unless it is clear from the context or the foregoing descriptionthat only one of A and B is intended. Further, the recitation of “atleast one of A, B and C” should be interpreted as one or more of a groupof elements consisting of A, B and C, and should not be interpreted asrequiring at least one of each of the listed elements A, B and C,regardless of whether A, B and C are related as categories or otherwise.Moreover, the recitation of “A, B and/or C” or “at least one of A, B orC” should be interpreted as including any singular entity from thelisted elements, e.g., A, any subset from the listed elements, e.g., Aand B, or the entire list of elements A, B and C.

REFERENCE NUMERALS

-   1 robot-   2 base-   3 arm-   4 end effector-   5 processor unit-   6 first workpiece-   7 conveyor-   8 second workpiece-   9 crate-   10 sensor-   11 wall, barrier-   12 passage-   13 safety zone-   14 rack-   15 passage-   16 safety zone-   17 passage-   18 object-   19 person-   20 crate-   21 safety zone-   22 combined object-   23 user interface-   24 tag-   25 radio interface

What is claimed is:
 1. A method for controlling a robot, comprising thesteps of: deciding whether there is a non-permanent object in a vicinityof the robot; if there is a non-permanent object, deciding whether theobject qualifies for extended protection or not; defining a safety zonearound the object which the robot must not enter or in which a maximumallowed speed of the robot is less than outside the safety zone, andcontrolling the robot based on the safety zone, wherein the safety zoneextends to a greater distance from the object if the object qualifiesfor extended protection than if it does not, wherein, if a second objecthas been judged not to qualify for extended protection, re-judging thesecond object to be qualified for extended protection if the distancebetween the second object and the object that qualifies for extendedprotection becomes less than a predetermined limit, wherein the secondobject is an inanimate object.
 2. The method of claim 1, wherein when athird object is detected to enter the vicinity of the robot, the thirdobject is judged to qualify for extended protection.
 3. The method ofclaim 1, wherein the vicinity comprises a workpiece entry point and athird object which enters the vicinity by the workpiece entry point isjudged not to qualify for extended protection.
 4. The method of claim 1,wherein if the distance between the second object and the object thatqualifies for extended protection increases again without having becomeless than a pre-set threshold, which may be defined as zero or as closeto zero, the second object is again judged not to qualify for extendedprotection.
 5. The method of claim 1, wherein if two objects come closeenough to each other to become undistinguishable and at least one of theobjects has been judged to qualify for extended protection, a resultingobject is judged to also qualify for extended protection.
 6. The methodof claim 1, wherein if a qualifying object splits into two or moreobjects, each resulting object is also judged to qualify for extendedprotection.
 7. The method of claim 1, wherein an object is judged not toqualify for extended protection if at least one of the followingcriteria is met: no motion of the object is detected within apredetermined time span; at least one detectable physical property ofthe object comprising at least size, shape, weight, or surfacetemperature is incompatible with a human being; the object is equippedwith a tag, and data read from the tag fit detectable physicalproperties of the object; the object is declared not to qualify forextended protection by an operator.
 8. A robot system, comprising: arobot; at least one sensor configured to surveil a vicinity of therobot; and a processor unit configured to control the robot based ondata from the at least one sensor using the method of claim
 1. 9. Anon-transitory computer program product, comprising: program codeconfigured to enable a computer to perform the method according to claim1.